linux-kernel - Re: [RFC v3 20/45] richacl: Automatic Inheritance

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 13 May 2015 23:05:44 +0200
From:	Andreas Grünbacher <andreas.gruenbacher@...il.com>
To:	Frank Filz <ffilzlnx@...dspring.com>
Cc:	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	linux-nfs@...r.kernel.org
Subject: Re: [RFC v3 20/45] richacl: Automatic Inheritance

2015-05-13 22:38 GMT+02:00 Frank Filz <ffilzlnx@...dspring.com>:
> So inheritance will happen, but there is also a mode set as part of the create that I assume
> is effectively handled the same as a subsequent chmod() on the file?

The effect is similar to a subsequent chmod except that the effective
permissions may be fewer then the create mode:

 * In the traditional POSIX case, the effective permissions are
   (create_mode & ~umask).

 * With POSIX ACLs and Richacls, if there are inheritable permissions,
   the effective permissions are the intersection of the create mode and
   the maximum permissions the inherited acl grants. So if the inherited
   acl grants at most rwxr-x---, with a create mode of rw-rw-rw, the
   effective permissions end up being rw-r-----.

> Any chance we could add a system call to do a open/create and pass an ACL
> (and heck, if we go there, why not a system call that allows creating with mtime,
> atime, owner, etc. also...).

Send patches, but expect them to get killed :)

> Is there a mode that we could pass that would cause the least amount
> of damage to the inherited ACL?

Yes, 0777. But the RICHACL_PROTECTED flag will still be set, and that
is the problem in this case.

Andreas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/